feat: attribution implementation

[feugy]

🖖 What's in there?

• Adds reset() to forget the user and group set by identify() and group(), for example on logout.
• Exports identify, group and reset from every framework entry (/react, /next, /remix, /vue, /sveltekit, /sveltekit-next, /nuxt), not only from the root.
• Server track() accepts userId, groupId and props in its options, like trackExposure() already did. trackExposure() also accepts them in its options, which take precedence over the same fields on the input.

🤺 How to test?

• pnpm -F @vercel/analytics test
• pnpm -F @vercel/analytics build, then check that each dist/**/index.d.ts exports group, identify and reset, and that dist/server/index.d.ts does not expose __cdp.

🔬 Notes to reviewers

• The browser reset() only pushes window.va('reset'). The script remembers and clears the profile; that logic lives in vercel/front#87213, which must deploy first.
• The server keeps no profile, by design (same as Segment, PostHog, Amplitude server SDKs): callers pass attribution explicitly, for example from their session. props goes through parseProperties() like event properties: throws in development, strips in production.
• server/profiles.ts is renamed to server/attribution.ts and gathers the shared Attribution type and attributionPayload() helper next to identify/group. Public exports are unchanged.

🔗 Related PRs

• vercel/front#87213 — the script side: persists identify/group and attaches userId, groupId, props to every row; handles reset.
• feat: add identify/group #210 — identify/group and CDP envelope, which this builds on.

[vercel]

Your Vercel team Analytics Test Projects is not permitted to deploy from this git repository. Contact an administrator to add github organization vercel as a Protected Git Scope in Analytics Test Projects on Vercel. Once added, commit again to see your changes.

Learn more: https://vercel.com/docs/security/protected-git-scopes